Privacy Policy
What this policy covers
This policy explains what roehn does with personal information connected to this website and to orders arranged through it. It describes the site as it is actually built, not a generic e-commerce stack.
Revised September 2026: the site now also runs Google's advertising tag, the newsletter signup stores your address so we can send the list to you, an ad click that leads to a newsletter or handbook signup is reported to Google in the same way a paid order already was, and we now give Meta and Google lists of hashed contact details of people who have ordered from us, started a checkout, or signed up or written to us, with, for Meta, the total each customer has spent with us, to measure and target our advertising; and our server now keeps the browser details it reports to Meta for a checkout with that order, so that the payment can be reported the same way. The sections on cookies, on advertising and on customer lists below describe exactly what each of these sends.
What we collect
We collect your name, email address, phone number (if you give one), delivery address, and a record of what you ordered and when. We also keep the email correspondence in which an order is arranged, and the order reference used to match your payment.
Almost all of this reaches us because you send it to us. The checkout, the handbook request and the newsletter signup send what you type to our server, where it is stored so we can act on it; at checkout, the contact details you enter are saved as you go, so we can follow up on an order you started but did not finish. The contact and wholesale enquiry forms do not transmit anything themselves: they give you a prefilled message to send from your own email app, and what you wrote reaches us only if you send it.
Signing in to your account
Account sign-in uses a six-digit code emailed to your address rather than a password, so there is no password for us to store or for anyone to steal. The code is kept only as a one-way hash, expires in ten minutes, can be used once, and is never written into our email records in readable form. A successful sign-in creates a session identified by a random token; we store only a hash of that token, with your email address and the expiry. The session lasts thirty days unless you sign out, which deletes it immediately. Signing in shows the orders placed with that email address, looked up by the address the code proved you can read — so no one can see an order history by claiming to be someone else.
We collect no card or bank data
This storefront has no payment fields. We never see, ask for, or store a card number, CVV, expiry, bank account number, or routing number. Most payment is a transfer you initiate yourself inside your own payment app, so those details stay with that app and with your bank. Where card payment is offered, it is completed on our secure payment page and the card is handled there by the payment processor — the card number never reaches us.
Cookies and browser storage
The site itself sets one cookie: roehn-age-verified. It records only that you confirmed you are 21 or older, contains no identifier and nothing about you, and expires after one year. Without it the age screen simply appears again on your next visit. Two more are set for advertising, as described below: Google's tag sets _gcl_au, and _gcl_aw when you arrive from one of our ads; and this site sets _fbp and _fbc for Meta.
The site also stores a few things in your own browser: your cart contents, your part-completed checkout details (kept only for the current browser session so a refresh does not lose them), the token for your account session if you sign in, a note of how you first arrived — the site or advertisement that referred you, the page you landed on, and any ad click identifier — and a referral code if you used one. The token is sent with your requests to prove you are signed in, and the arrival note and referral code are sent to us with an order or a signup, so we know which advertising or partner brought it. Clearing your browser's site data for this domain removes all of it.
Advertising measurement: Google Ads
We also advertise on Google Search. Google adds a click identifier to the web address when you arrive from one of our ads. That identifier is stored in your own browser and, if you go on to place an order or sign up for the newsletter or the handbook, recorded against that order or signup. It identifies the advertisement you clicked, not you.
When an order is paid for, or when you sign up after arriving from one of our ads, we report that click identifier back to Google with the time it happened and, for an order, the amount — so that Google can tell which advertisements led to a sale or a signup. These conversion reports do not include your name, your email address, your telephone number or your delivery address. Separately, Google receives the customer lists described below.
This site also loads Google's advertising tag, which tells Google Ads which pages you view and sets the first-party cookies _gcl_au and, after an ad click, _gcl_aw, used to connect that click to what you do next. A content blocker, or the tracking protection in your browser, stops it running, and the site works identically without it.
Advertising measurement: Meta
We advertise on Facebook and Instagram, and measure whether that advertising works by reporting a few things to Meta. Meta's own pixel script is not loaded on this site: the reports are short requests sent from your browser by our own code, to the Meta account that runs our ads, and there are four. A visit to our homepage or one of our landing pages (the handbook, the supplier checklist, the offer page and the paper), when it is the first page you open here, with that page's address and the tags of the ad you clicked, if any; a handbook or checklist requested; a click on the offer page's button through to the shop; and an item added to the bag. None of them names a product, a price, or any other page you view: the report of an item added to the bag names our homepage as the page, whatever page you were on, and carries no product, value or quantity. If you have given us your email address — by signing in, saving your bag, claiming the scratch-card offer or placing an order — that report can also carry your email address, converted to a one-way hash in your browser before it is sent. Signing out of your account removes that hash from your browser.
So that the measurement holds when a browser blocks those requests, our server also reports to the same Meta account, through the Meta Conversions API: an order placed, an order paid for, a handbook or checklist requested, and an item added to the bag. For an order, the report carries its value and our order reference, never what was ordered; the report of an item added carries nothing about the item. A report can also carry your IP address and browser identification, the _fbp and _fbc identifiers described below, and your email address, which is converted to a one-way hash before it leaves our server, so Meta can match the event to an account it already holds but cannot read the address from what we send; the IP address, browser identification and _fbp and _fbc identifiers are sent as they are, because that is the form in which Meta matches them. So that a payment which arrives after the checkout can be matched in the same way, our server keeps those browser details from the checkout with the order. Every report carries a reference that lets Meta count it once when both your browser and our server report the same thing. If your browser sends Global Privacy Control, none of these reports is made about you, from your browser or from our server, and the two cookies below are not set.
For those reports this site sets two cookies of Meta's design on roehn.co itself: _fbp, which identifies the browser to Meta and lasts 90 days from your last visit, and _fbc, which records the Meta ad you clicked to arrive here, if any, and lasts 90 days from that click. If your browser has since deleted _fbc, then for seven days after that ad click we send the same record, rebuilt from the ad link you arrived by, which this site keeps in your browser. Meta uses what it receives under its own privacy policy, at https://www.facebook.com/privacy/policy, and may combine it with your Meta account. You can limit how Meta uses this data for advertising in your Facebook settings, under Accounts Center and then Ad preferences. A content blocker, or the tracking protection in your browser, can stop the requests sent from your browser, and the site works identically without them.
There is nothing else: no analytics suite, no session recording, no heatmaps, and no advertising tracker beyond Google's and Meta's. We do not sell personal information. Beyond the reporting described in these two sections and the customer lists described in the next, we do not share it for advertising.
Customer lists shared with Meta and Google
We also give Meta and Google lists of contact details, such as email addresses, of people who have ordered from us, started a checkout, or signed up or written to us. The list we give Meta also carries, for each customer, the total they have spent with us.
Each contact detail is converted to a one-way hash before it is uploaded, and the lists never say what anyone bought. Meta and Google use them to match those people to accounts they already hold, so that our advertising can include them or leave them out and, on Meta, reach people similar to them.
How we use what you give us
We use your information to answer your enquiry, to price and confirm an order, to match your payment transfer to that order, to address and dispatch your shipment, to handle a shipping or certificate problem, and to keep the records that tax and compliance rules require of us. We do not use it for automated decision-making.
Text messages
The mobile number you give at checkout is used to send delivery alerts about that order by text: that it has shipped, with its tracking number, and that it has arrived. Those are notices about your order, not advertising, and they end when the order does.
We send marketing texts only to people who have separately ticked the marketing-texts box at checkout. That box is never pre-ticked, agreeing is not a condition of purchase, and the exact wording you agreed to is stored with your consent. Reply STOP to any message to stop marketing texts, or HELP for help. Message frequency varies, and message and data rates may apply.
Texts are delivered through Twilio, which handles the number and the message content on our behalf. Mobile numbers and text-message consent are not shared with, or sold to, any third party for their own marketing.
Who else sees it
Your name, delivery address, and phone number are given to the shipping carrier so it can deliver your parcel. Separately, when you send payment, the payment app you chose — Zelle, Apple Cash, Revolut, or a cryptocurrency checkout — handles that transfer under its own privacy policy and its own terms, which we do not control; we see only what that app shows a recipient, such as the sender name and the memo. Google and Meta receive the advertising-measurement reports and the hashed customer lists described above, in the form described there. Twilio delivers the text messages described above and sees the mobile number and the message content. We otherwise do not disclose your information, except where we are legally required to.
How long we keep it
Records tied to a completed order — what was sold, to whom, to what address, and how it was paid — are kept for as long as tax, accounting, and product-compliance rules require us to keep them. Enquiries that do not become orders, and marketing correspondence, are deleted when you ask us to.
Access, correction, and deletion
You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing support@roehn.co from the address on the order or enquiry. We will respond within the time your local law allows, and we will tell you if a record has to be kept for a legal reason. There is no self-service data-download or account-deletion screen on this site; email us and we will handle it.
21 and over
This site is age-gated and is not directed at anyone under 21. We do not knowingly collect personal information from minors. If you believe a minor has given us information, email support@roehn.co and we will delete it.
Security
The site is served over HTTPS. The strongest protection here is structural rather than technical: we hold no payment credentials and no passwords for this storefront, so there is no card or credential store to breach. Information you send us by email travels as ordinary email, which is not end-to-end encrypted — please do not send us financial details, identity documents, or anything else sensitive that we have not asked for.
Changes to this policy
We may update this policy by posting a revised version on this page with a new revision date. If a change materially affects what we collect or who we share it with, we will say so at the top of the page.
Status of this document
This notice describes how roehn and this website actually handle information. It is the current privacy policy for the site, and it applies to every order and enquiry made through it.